Dual-redundancy control system of aero-engine

Abstract

The invention discloses an aero-engine dual-redundancy control system which comprises a plurality of sets of control subsystems, and each set of control subsystem comprises a controller, a sensor and an actuator. Wherein the controllers in each group control the actuators in the group according to signals collected by the sensors in the group. Compared with the prior art, one controller is only responsible for controlling the executors in the group and does not control the executors in other groups, so that compared with the prior art, the quantity of data needing to be processed by the controller is reduced, the response time of the system is shortened, the delay is reduced, the working efficiency of the control system can be improved, and the performance can be improved; and the problem of collapse of the control system can be effectively avoided, so that normal use of the engine is ensured.

Description

Technical Field

[0001] The invention relates to a control system of an aircraft engine, and in particular to a dual-redundancy control system of an aircraft engine. Background Art

[0002] Aircraft engines operate under high temperature, high pressure, high speed and strong vibration, so their control systems have high reliability requirements, and the normal operation of aircraft engines is directly related to the personal safety of pilots. In addition to high reliability requirements for various components and parts, dual redundant control systems are currently usually used to control the engine, so that even if some components are damaged, the operation of the aircraft engine can be guaranteed.

[0003] Chinese patent document CN106483949A discloses an aviation dual-controller switching control algorithm, which controls the aircraft engine by adopting a dual redundant control system. The dual redundant control system includes a sensor, a control unit, a switching unit and an actuator connected in sequence; the control unit includes a controller ECU_A and a controller ECU_B respectively connected to the switching unit, and the two controllers respectively send a switching control signal to the switching unit; after receiving the switching signal, the switching unit drives the execution of the switching action; the switching unit provides a feedback signal of the switching state to the two controllers according to the switching state, and the two controllers judge whether the switching is completed according to the read feedback signal, thereby ensuring the rationality of the dual controllers' drive control of the actuator, the timeliness of the switching, and the stability and safety of the engine operation control.

[0004] In the prior art, dual control is used to control the actuator, so when one of the controllers fails, the other controller can be switched to control the actuator to ensure the normal operation of the engine. However, in the actual operation process, when the actuator fails, the engine still fails and cannot be used normally.

[0005] Therefore, there is another Chinese patent document CN113202629A that discloses a dual redundant control system for aircraft engines, providing the hardware and software design of the dual redundant control system for aircraft engines, including: a redundant power supply module for powering the entire control system; a redundant acquisition and conditioning interface unit for filtering, conditioning, and amplifying the parameter signals of various sensors of the engine; a redundant control unit for calculating and analyzing the parameters collected by the redundant parameter acquisition unit, judging the working condition of the engine, and outputting control signals; a redundant execution unit for executing corresponding actions such as ignition, fuel injection, and jet injection according to the output signal of the control unit. With this technical solution, the redundancy of each part ensures that the aircraft engine can still operate in the event of a failure. The hierarchical architecture and redundant control strategy in the control unit ensure that the aircraft engine can work normally or with slightly reduced control indicators when a failure occurs, under the premise of meeting the control objectives and indicators of the general control system.

[0006] In the prior art, both the controller and the execution unit are dual-redundant, so no matter if the controller or the execution unit fails, the other controller and the execution unit can also ensure the normal operation of the engine. However, in actual operation, as the control system is used for a longer time, the response time of the control system will be significantly longer, the work efficiency will be lowered, the performance will be reduced, and even the system will crash, resulting in the engine not being able to operate normally. Summary of the invention

[0007] In order to solve the technical problem of low working efficiency of the control system in the prior art, the present invention provides an aircraft engine dual redundant control system, including multiple groups of control subsystems, each group of control subsystems includes a controller, a sensor and an actuator; wherein: the controller of each group controls the actuator in the group according to the signal collected by the sensor in the group.

[0008] In the prior art, since the controller needs to output control signals to each actuator according to the situation of the engine, and each actuator is provided with redundant actuators, the controller in the dual redundant control system of the prior art needs to process the redundant signals. Therefore, the controller needs to process a large amount of data, and the amount will increase, which will cause the system response time to become longer, the delay to become longer, and ultimately lead to low system efficiency, performance degradation, system crash and other problems.

[0009] In this solution, although there are multiple groups of actuators, during normal operation, each group of actuators will only be controlled by the controller within the group. That is to say, one controller is only responsible for controlling the actuators within the group and will not control the actuators of other groups. Therefore, compared with the prior art, the amount of data that the controller needs to process is smaller, so the system response time will become faster and the delay will be reduced, so that the working efficiency of the control system can be improved, and the performance can also be improved, which can effectively avoid the problem of control system crash, thereby ensuring the normal use of the engine.

[0010] Preferably, each group of controllers is connected in communication, and when the controller of one group of control subsystems fails, the remaining control subsystems compensate for the loss of the failed control subsystem. Since an actuator can only be controlled by one controller, when the controller fails, the group of control subsystems will fail completely, so the workload responsible for the group of control subsystems will be missing, resulting in the engine not being able to operate normally. In this solution, when one group of control subsystems fails, the remaining control subsystems compensate for the loss of that part, which can ensure the normal operation of the engine.

[0011] Preferably, when one of the sensors fails, the controller controls the actuator according to the signals collected by the remaining sensors. In this solution, when one of the sensors fails, the sensor signals of the remaining sensors are used as approximate substitute values, so the controller can output the control signal of the actuator according to the approximate substitute value, and the actuator can operate normally, thereby ensuring the normal operation of the engine.

[0012] Preferably, the sensor includes a pressure sensor for collecting atmospheric pressure. Since the air density of the environment where the engine is located will change significantly with the change of flight altitude, which will directly affect the amount of circulating oil in the engine, the atmospheric pressure signal is a key input signal to ensure the normal operation of the aircraft engine. In this scheme, after each group of control subsystems is provided with a pressure sensor for collecting atmospheric pressure, when the pressure sensor of one group of control subsystems fails, the atmospheric pressure collected by the pressure sensor of another group of control subsystems can be shared as a substitute, so that the normal operation of the control subsystem of this group can be ensured, thereby ensuring the normal operation of the engine. On the other hand, multiple pressure sensors will collect multiple groups of atmospheric pressures, and multiple groups of atmospheric pressures can be mutually verified, and the measurement accuracy of atmospheric pressure can also be improved, thereby ensuring the control accuracy of the control subsystem.

[0013] Preferably, the sensor also includes a cylinder temperature sensor for collecting the temperature of the engine cylinder. This solution can improve the reliability of the control system.

[0014] Preferably, each group of controllers receives a flameout signal, and when one group of controllers fails to receive a flameout signal, the flameout signal is obtained from the remaining group of controllers. This solution can ensure the normal flameout operation.

[0015] Preferably, a shared sensor is also included, and the controller of each group controls the actuator of each group according to the signal collected by the shared sensor. Considering that during the operation of the engine, the control of some actuators is not sensitive to data delay, control can be achieved through data sharing, and it is not necessary to set up corresponding sensors for each control subsystem. Therefore, in this solution, a shared sensor is set to process this part of the data collection, which can reduce the cost of the control system and also reduce the complexity of the control system.

[0016] Preferably, the actuator includes an oil inlet assembly, and each cylinder of the engine is provided with multiple sets of oil inlet assemblies, and each set of controllers controls one set of oil inlet assemblies in each cylinder. When one set of oil inlet assemblies fails, the remaining controllers control the remaining oil inlet assemblies in the cylinder to compensate. In this solution, after each cylinder is equipped with multiple sets of oil inlet assemblies, sufficient oil inlet volume in the cylinder can be guaranteed, and the normal operation of the cylinder can also be guaranteed.

[0017] Preferably, the fuel inlet assembly includes a fuel injector and an air jet. When the fuel injector or the air jet fails, the air jet or the fuel injector of the fuel inlet assembly stops working. Since the fuel is mixed unevenly at high speed, in this solution, the airflow ejected from the air jet is used to guide the fuel ejected from the fuel injector, which can greatly reduce the fuel injection loss rate, improve the atomization effect of the fuel, and improve the combustion stability and high efficiency of the fuel, thereby improving the working efficiency of the engine.

[0018] Preferably, when one of the oil inlet components in the cylinder fails, another controller controls the oil injection amount and advance angle of the other oil inlet component to increase. In this solution, the loss of the part of the oil inlet component that fails is compensated by increasing the injection amount and advance angle of the other injection group, thereby ensuring the normal operation of the engine.

[0019] Preferably, the controller increases the current pulse width and advance angle of the fuel inlet component jet nozzle when controlling the fuel inlet component to compensate. Since the jet nozzle only brings fuel into the cylinder through jetting, the air-fuel ratio does not need to be considered. Therefore, in this solution, the relevant performance parameters of the jet nozzle do not need to be double redundant, thereby reducing the requirements for ECU driving ability, which is further beneficial to cost control.

[0020] Preferably, when one controller is abnormal, the other controllers control the other oil inlet components in the cylinder to compensate. This solution can ensure the normal operation of the engine.

[0021] Preferably, multiple controllers communicate using multiple communication methods at the same time. Communication between multiple controllers can confirm whether the controller is working properly, and in this solution, the setting of redundant communication provides an additional path to determine whether the controller is working properly, ensuring that the controller redundancy strategy will not be triggered by mistake.

[0022] The present invention has the following beneficial effects: 1. In the present invention, from the system architecture level, the distributed arrangement of actuators based on multi-point injection is used as the starting point, and sensors and controllers are also dispersed at the same time, which not only reduces the design complexity and cost of a single controller, but also has redundant operation capabilities; the system response time will become faster, the delay will be reduced, the working efficiency of the control system can be improved, and the performance can also be improved, which can effectively avoid the problem of control system crash, thereby ensuring the normal use of the engine.

[0023] 2. In the present invention, when one set of control subsystems fails, the remaining control subsystems compensate for the loss of that part, that is, increase the output capacity of the actuator of another control subsystem to ensure the normal operation of the engine.

[0024] 3. In the present invention, when one group of sensors fails, the sensor signals of the remaining groups are used as approximate substitute values, the data are interconnected, and the key measuring point information is shared between the two controllers, thereby realizing the numerical replacement of the sensor and the energy efficiency compensation of the actuator.

[0025] 4. The present invention can adaptively replace components of the control system to the maximum extent possible when they fail, temporarily ensuring aviation flight safety and preventing irreversible loss of life and property. Currently, the engine equipped with this control system has completed multiple rounds of tests and first flight verification, and the system is safe and reliable. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 A schematic diagram of an embodiment of a dual redundant control system for an aircraft engine according to the present invention; Figure 2 The figure is a control schematic diagram of a cylinder in an embodiment of an aircraft engine dual redundant control system of the present invention. DETAILED DESCRIPTION

[0027] The following is further described in detail through specific implementation methods: The embodiment is basically as shown in the attached Figure 1As shown: A dual redundant control system for an aircraft engine, including multiple control subsystems, each control subsystem includes a controller, a sensor, a shared sensor and an actuator. The controller of each group controls the actuator in the group according to the signal collected by the sensor in the group. The sensor includes a pressure sensor for collecting atmospheric pressure and a cylinder temperature sensor for collecting the engine cylinder body; the controller of each group controls the actuator of each group according to the signal collected by the shared sensor, such as the control of the lubricating oil pump and the electronic water pump. Each group of controllers is connected in communication, and multiple controllers communicate simultaneously using multiple communication methods. When the controller of one group of control subsystems fails, the remaining control subsystems compensate for the loss of the failed control subsystem. Specifically, when one group of sensors fails, the controller of this group controls the actuator of this group according to the signal collected by the remaining group of sensors.

[0028] The actuator includes an oil inlet assembly. Each cylinder of the engine is provided with multiple groups of oil inlet assemblies. Each group of controllers controls one of the oil inlet assemblies in each cylinder. When one of the oil inlet assemblies fails, the remaining controllers control the remaining oil inlet assemblies in the cylinder to compensate. When one controller is abnormal, the remaining controllers control the remaining oil inlet assemblies in the cylinder to compensate. Specifically, the oil inlet assembly includes a fuel injector and an air jet. When the fuel injector or the air jet fails, the air jet or the fuel injector of the oil inlet assembly stops working. When one of the oil inlet assemblies in the cylinder fails, another controller controls the fuel injection amount and advance angle of the fuel injector of another group of oil inlet assemblies to increase, and increases the injection pulse width and injection advance angle of the fuel inlet assembly air jet.

[0029] The specific implementation process is as follows: In this embodiment, the control subsystem is provided with two groups, and the controller includes controller A and controller B. The software and hardware status of controller A and controller B are completely consistent, and controller A and controller B interact with each other through CAN communication link and RS485 communication link to realize data interaction. The engine in this embodiment is a two-stroke engine, a piston engine, which adopts a two-cylinder horizontally opposed mode, and the two cylinders are cylinder 1 and cylinder 2. During the operation of the engine, the cylinder temperature sensor connected to controller A and the cylinder temperature sensor connected to controller B use the cylinder temperature of cylinder 1 and cylinder 2 respectively. When the cylinder temperature sensor collected by controller A fails, the cylinder temperature of cylinder 2 collected by controller B is obtained through CAN communication as an approximate substitute value of the cylinder temperature of cylinder 1. When the cylinder temperature sensor collected by controller B fails, the cylinder temperature of cylinder 1 collected by controller A is obtained through CAN communication as an approximate substitute value of the cylinder temperature of cylinder 2.

[0030] Similarly, controller A and controller B are both integrated with a pressure sensor. On the one hand, they can verify each other to improve the measurement accuracy of atmospheric pressure. On the other hand, if one of the atmospheric pressure sensors fails, the atmospheric pressure data can be replaced through CAN communication data sharing.

[0031] The flameout signal is used as an emergency shutdown control signal for the engine. The physical cables that transmit the flameout signal are connected to controller A and controller B respectively. When one of the cables is open, the flameout signal received by the other ECU can be obtained through CAN communication to achieve correct flameout.

[0032] In addition to the approximate replacement of similar sensors, this system also has physical redundancy. Controller A and controller A respectively collect signals from crank position sensors arranged at different positions on the same encoder. The crank position signal, as a key signal for engine operation, can identify the engine speed and crankshaft position information. When one of the crank position signals fails, the engine can still achieve limp operation. The specific implementation method is, for example, if the crank position signal connected to controller A fails, controller A can no longer obtain the engine speed and crankshaft position information through its own sensor. Even if the CAN communication data is shared, due to the communication delay, the injection ignition cannot be correctly executed according to the phase, so controller A can only stop the injection ignition. However, for some controls that are not sensitive to data delays, control can be achieved through data sharing, specifically, the control of the lubricating oil pump and the electronic water pump can still be achieved.

[0033] Two groups of oil inlet components are arranged in each cylinder, that is, two oil injection nozzles and two air jet nozzles are arranged in each cylinder. Controller A and controller B respectively control one group of oil inlet components in two cylinders, that is, controller A controls one group of oil inlet components 1 of cylinder 1 and cylinder 2, and controller B controls another group of oil inlet components 2 of cylinder 1 and cylinder 2. For a single cylinder, the oil injection and air jet operations are controlled by controller A and controller B together, such as Figure 2 When the fuel injector or air jet in the same fuel inlet assembly fails, the air jet or fuel injector in the group will stop working.

[0034] When a group of oil inlet components in the same cylinder body fails, the normal working oil inlet components will compensate for it. The specific situation is as follows: ① When the fuel injector 1 or jet nozzle 1 of cylinder 1 of controller A fails, controller B increases the fuel injection amount of fuel injector 2 of cylinder 1 and increases the injection advance angle. The fuel injection pulse width and advance angle of jet nozzle 2 of cylinder 1 controlled by controller B increase.

[0035] ② When the fuel injection nozzle 1 or jet nozzle 1 of cylinder 2 controlled by controller A fails, controller B increases the fuel injection amount of fuel injection nozzle 2 of cylinder 2 and increases the injection advance angle. The injection pulse width and advance angle of jet nozzle 2 of cylinder 2 controlled by controller B increase.

[0036] ③ When the fuel injector 2 or jet nozzle 2 of cylinder 1 controlled by controller B fails, controller A increases the fuel injection amount of fuel injector 1 of cylinder 1 and increases the injection advance angle. The injection pulse width and advance angle of jet nozzle 1 of cylinder 1 controlled by controller A increase.

[0037] ④ When the fuel injector 2 or jet nozzle 2 of cylinder 2 controlled by controller B fails, controller A increases the fuel injection amount of fuel injector 1 of cylinder 2 and increases the injection advance angle. The injection pulse width and advance angle of jet nozzle 1 of cylinder 2 controlled by controller A increase.

[0038] In the above process, the value of the fuel injection amount increased by the fuel injector is the fuel injection amount that should be injected by the faulty oil and gas passage. The increase in injection advance angle and injection pulse width is determined by the conversion of the increased injection amount and the speed. When both sets of fuel inlet components in the same cylinder fail, the engine changes from double cylinder to single cylinder operation, and the throttle opening is directly adjusted to maintain power. The specific strategy is implemented by the speed closed-loop strategy.

[0039] The above is only an embodiment of the present invention. The common sense such as the known specific structure and characteristics in the scheme is not described in detail here. The ordinary technicians in the relevant field know all the common technical knowledge in the technical field of the invention before the application date or priority date, can obtain all the existing technologies in the field, and have the ability to apply the conventional experimental means before that date. The ordinary technicians in the relevant field can improve and implement this scheme in combination with their own abilities under the enlightenment given by this application. Some typical known structures or known methods should not become obstacles for ordinary technicians in the relevant field to implement this application. It should be pointed out that for those skilled in the art, without departing from the structure of the present invention, several deformations and improvements can be made, which should also be regarded as the protection scope of the present invention, which will not affect the effect of the implementation of the present invention and the practicality of the patent. The protection scope required by this application shall be based on the content of its claims, and the specific implementation methods and other records in the specification can be used to interpret the content of the claims.

Claims

1. An aircraft engine dual redundant control system, comprising a plurality of control subsystems, each control subsystem comprising a controller, a sensor and an actuator; characterized in that: The controller of each group controls the actuators in the group according to the signals collected by the sensors in the group.

2. The dual redundant control system of an aircraft engine according to claim 1, characterized in that: Each group of controllers is connected in communication. When a controller of one group of control subsystems fails, the remaining control subsystems compensate for the loss of the failed control subsystem.

3. The dual redundant control system of an aircraft engine according to claim 2, characterized in that: When one group of sensors fails, the controller controls the actuators according to the signals collected by the remaining group of sensors.

4. The dual redundant control system of an aircraft engine according to claim 3, characterized in that: The sensor comprises a pressure sensor for collecting atmospheric pressure.

5. The dual redundant control system of an aircraft engine according to claim 4, characterized in that: The sensor also includes a cylinder temperature sensor for collecting the temperature of the engine cylinder.

6. The aircraft engine dual redundant control system according to claim 5, characterized in that: Each group of controllers receives a flameout signal. When one group of controllers fails to receive a flameout signal, it obtains a flameout signal from the remaining group of controllers.

7. The dual redundant control system of an aircraft engine according to claim 6, characterized in that: It also includes a shared sensor, and the controller of each group controls the actuator of each group according to the signal collected by the shared sensor.

8. The dual redundant control system of an aircraft engine according to any one of claims 1 to 7, characterized in that: The actuator includes an oil inlet assembly. Multiple groups of oil inlet assemblies are provided in each cylinder of the engine. Each group of controllers controls one group of oil inlet assemblies in each cylinder. When one group of oil inlet assemblies fails, the remaining controllers control the remaining oil inlet assemblies in the cylinder to compensate.

9. The dual redundant control system of an aircraft engine according to claim 8, characterized in that: The oil inlet assembly comprises an oil spray nozzle and an air jet nozzle. When the oil spray nozzle or the air jet nozzle fails, the air jet nozzle or the oil spray nozzle of the oil inlet assembly stops working.

10. The aircraft engine dual redundant control system according to claim 9, characterized in that: When one of the oil inlet components in the cylinder body fails, another controller controls the oil volume and advance angle of the injector of the other oil inlet component to increase.

11. The aircraft engine dual redundant control system according to claim 10, characterized in that: When the controller controls the oil inlet assembly to perform compensation, the controller increases the current pulse width and advance angle of the jet nozzle of the oil inlet assembly.

12. The aircraft engine dual redundant control system according to claim 11, characterized in that: When one controller is abnormal, the remaining controllers control the remaining oil inlet components in the cylinder body to compensate.

13. The aircraft engine dual redundant control system according to claim 12, characterized in that: Multiple controllers communicate simultaneously using multiple communication methods.

Images